-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from missing CSRF protection in the edit action's document preparation logic. The patched commit shows the vulnerable code path in prepareEditedDocument() handled document modifications without checking the CSRF token. This function is directly responsible for processing user-submitted content changes, and its pre-patch version failed to validate() request authenticity, making it the entry point for CSRF-based privilege escalation and code injection attacks. The addition of CSRFToken validation in this method in the fix confirms its critical role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 1.0, < 14.10.7 | 14.10.7 |
| org.xwiki.platform:xwiki-platform-oldcore | maven | >= 15.0, < 15.2-rc-1 | 15.2-rc-1 |